Here is a screenshot of the process. It was more obvious before since I could see it connecting to bogus urls. Now it starts up, it gets killed by a cscript.exe, and after a while wscript starts it up again.Both wscript and cscript seem to be using data.js in the ComObjects directory.

Files\Folders moved on Reboot...File move failed. C:\Users\agustin\AppData\Local\Temp\FXSAPIDebugLogFile.txt scheduled to be moved on reboot.File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

WSH is not really a requirement on windows so lets disable it and see what happens I have tested it on my windows 7 with no ill effect

Download Noscript.exe to the desktop. http://www.symantec.com/avcenter/noscript.exeDouble-click the Noscript.exe icon. The Norton Script Disabler/Enabler appears. If the WSH is currently enabled on the system, you will be prompted as to whether you want to disable it. To do so, click Disable, and then click OK. If the WSH is currently disabled on the system, you will be prompted as to whether you want to enable it. To do so, click Enable, and then click OK.